HIPAA Leniency in Wake of Hurricane Harvey Disaster Declaration

For many Americans, it was one of the first widely circulated photos capturing the devastation wrought by the landfall of Hurricane Harvey in Texas. The photo showed approximately eight residents of an assisted living facility, La Vita Bella, in Dickinson, TX, sitting in what looks to be an activities area, with flood waters as high as the residents’ waists. The photo was taken by the facility’s owner, according to the New York Times.

Under normal, non-disaster circumstances, photos of residents under duress—or unauthorized photos of residents, period—in a covered entity would constitute a HIPAA violation. However, according to a “Limited Waiver of HIPAA Sanctions and Penalties During a Declared Emergency,” which was issued by the US Department of Health and Human Services (HHS) in the wake of Hurricane Harvey, although the HIPAA Privacy Rule is not suspended, “the Secretary of HHS may waive certain provisions of the Privacy Rule under the Project Bioshield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act.”

Because HHS Secretary Tom Price declared a public health emergency in Texas and Louisiana following the President’s emergency declaration, Price used his authority to waive sanctions and penalties against a covered hospital that does not comply with the following provisions of the HIPAA Privacy Rule. Those provisions include:

The requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).

The requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a).

The requirement to distribute a notice of privacy practices. See 45 CFR 164.520.

The patient’s right to request privacy restrictions. See 45 CFR 164.522(a).

The patient’s right to request confidential communications. See 45 CFR 164.522(b).

Even without an official declaration, HIPAA gives providers flexibility in sharing information about a patient in emergency situations. One of those allowed disclosures comes in circumstances including “imminent danger.”

According to the Hurricane Harvey HIPAA bulletin, under the imminent danger designation: “Health care providers may share patient information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public – consistent with applicable law… Thus, providers may disclose a patient’s health information to anyone who is in a position to prevent or lessen the threatened harm, including family, friends, caregivers, and law enforcement, without a patient’s permission.”

From the many press accounts explaining the circumstances of the photo, the person who took the photo and released it to friends, patients’ family members, and social media certainly believed the residents were in imminent danger.

The photo was taken by La Vita Bella owner Trudy Lampson, whose daughter, Kim McIntosh told CNN that Lampson had been told by local authorities not to evacuate, but rather stay put and follow their disaster plan. McIntosh also told CNN that the water became waist deep 10 to 15 minutes after water started seeping in.

“That’s when we decided to go ahead and tweet the photos, because we were afraid she wasn’t going to get any help,” McIntosh told CNN’s Chris Cuomo.